Set session timeout for console / remote access

[Mohd Nazly Othman]

Hi All,

I have HPUX 11.11 and 11.00 systems.

1. If a person login directly to the console, how do i set a session timeout if the person left the console for a long period of time. This practice to 'cut off' the session is a must in our IT security guidelines.

2. I am using puTTY (ssh) and winscp (sftp) to remotely telnet and ftp files from the HPUX system. If a person ssh / sftp to the system from the remote PC, how do i set the session time out for it?

Appreciate your guys advise. Thank you.

[Mel Burslan · Accepted solution]

in /etc/profile you can set the TMOUT value to whatever you need (in seconds) and any user but root is bound by this variable and users will not be able to change it, regardless they are on console or any other terminal. root user gets kicked out when the time limit gets hit but root is able to change it to higher values if need be.

[A. Clay Stephenson]

By setting the TMOUT environment variable to a non-zero number of seconds after the ${PS1} is last displayed , the shell will automatically terminate. This will not terminate processes which run under the shell --- which is a good thing. It is state of the art dumb to have a watchdog daemon which will automatically terminate seemingly idle because you may be doing a very important task (such as a restore of a large filesystem) that output nothing and yet is actually far from idle. Such daemons have their place but they must be very carefully designed and carefully adminisitered.

[Bill Hassell]

Just to clarify TMOUT. The shell counts the seconds when no key is pressed on the keyboard. However, TMOUT can be changed by any user unless it is given the readonly quality. So in /etc/profile, you can set all users (including root) to have their login shell timeout in 10 minutes of inactivity with:

export TMOUT=600
readonly TMOUT

Now, not even root can change the value of TMOUT.

[Mohd Nazly Othman]

Hi Guys,

thanx for the response. I've checked the /etc/profile but couldn't find any TMOUT= or readonly enttry. Should I just vi /etc/profile and put somewhere TMOUT=300 or something is missing in the profile? PLease guide.

[Darrel Louis]

Hi,

You need to add the entries to the /etc/profile.
# vi /etc/profile

Add the following lines:
export TMOUT=300
readonly TMOUT

Darrel

[Mohd Nazly Othman]

hi darrel, thanx for responding.

Ok i will try to put the entry
export TMOUT=300
readonly TMOUT

But my other concern is, what if during a specific of time, a remote PC that can sftp (im using winscp) to the HPUX 11.11/00 system is transfering a huge file that may take 1-2 hours to complete, is this TMOUT will terminate the file transfer as well as the session after 5 minutes the PC is left out ?

[Bill Hassell]

No. As mentioned before, TMOUT is only counted when the shell is running. When you start FTP, the shell stops running. Hours later, when the FTP transfer is complete, the shell starts running and the counter starts from zero again.

[Mohd Nazly Othman]

Hi Bill,

What a crystal clear answer.

Guys, I've put entry export TMOUT=300
readonly TMOUT and yes the time out session is fully kicking.

Thanx guys for the support. Have a nice day ahead ! Till then.

[Fauziah Mahdan]

Ok I am continue this task from Nazly. I need to clarify the console logout will terminate all login after it reach the session. What about tar and restore and fbackup command as clay informed? It may takes quite some times to finish and I don't want to be quit from the console.
Clay, what do you means by all the shell command wont terminate? Did you mean the process still running even thr root id has been kick out from the console?
Is any other way to be stay in console too?


Fauziah Mahdan

[Bill Hassell]

> I need to clarify the console logout will terminate all login after it reach the session.

HP-UX doesn't really have sessions, just processes that are running, some with a connection to a terminal. When you login, you get a login shell process and that is what TMOUT affects.

> What about tar and restore and fbackup command...

If you start any command (vi, tar, fbackup, etc) the shell stops running and therefore the TMOUT value has no meaning. When the command (actually, a child process of the shell), then the shell starts counting again (from zero).

> Did you mean the process still running even thr root id has been kick out from the console?

The shell will not terminate due to TMOUT until it has been running for that length of time. Waiting for other processes means the shell is not running at that time. So you won't get kicked out.

Now it's important to note that if someone turns off the console or terminates a remote connection like telnet, HP-UX will signal the login shell that a hangup has occured (like hanging up the telephone) so the shell is signaled to terminate using the SIGHUP signal. Normally, the shell will then terminate all subprocesses.

To protect a long process like tar or fbackup from being terminated due to a connection problem, start the process in the background with & and protect the process from SIGHUP using the nohup program like this:

nohup tar cvf /dev/rmt/0m /var /opt &

Now if you remove the power from the console or a remote session is disconnected, the tar process will be transferred to init to continue running.

[Fauziah Mahdan]

Hi Bill, Thanks for the explanation.
Yesterday I run tar command from console, but still after 5 minutes the console log out. TIMEOUT set to 300. Why it still kick me out even I run tar command. I will need to run fbackup for full backup next 18 August which may takes few hrs and I don't want to be kick out from the console but with this timeout setting. How?


Fauziah Mahdan

[Bill Hassell]

I sounds as if you ran tar in the background but did you also protect it with nohup?

[Fauziah Mahdan]

Ok Bill,
Sorry after read again your msg I get it.
Sorry.
Will try afterwards.


Thanks
Fauziah Mahdan

[Eduardo B Ribeiro]

Ok, but in this topic I still with an issue.

My servers run some applications with licenses limited to a determined number of simultaneous client sections. Since I know some people still connected and goes take a coffe and bla bla bla for a while... Can I drop this connection using some kind of timeout/idletime in terminal (pty), telnetd (server) or network configs?

Ok, I don't want to run a external utility like Watcher (http://www.madgoat.com/watcher.html) showed on other posts. This machine work in very high loads and run extra monitors could stablish a real trouble situation to menage before.

When the user login (through telnetd) your .profile defines the environment and starts the application, so the shell process cannot be used to "TMOUT"...
The system terminals could monitor idleness too?

Best regards,

Eduardo Ribeiro

[Bill Hassell]

> My servers run some applications with licenses limited to a determined number of simultaneous client sections. Since I know some people still connected and goes take a coffe and bla bla bla for a while... Can I drop this connection using some kind of timeout/idletime in terminal (pty), telnetd (server) or network configs?

No, the application has control of the terminal session. You must ask the manufacturer of the software how to configure a session timeout. If there is no timeout feature, consider finding another product.

> Ok, I don't want to run a external utility like Watcher (http://www.madgoat.com/watcher.html) showed on other posts. This machine work in very high loads and run extra monitors could stablish a real trouble situation to menage before.

There is nothing in the OS that will accomplish what you want. One way or another, you have to monitor the connections and determine if there is any activity. who -u will indicate how long the terminal has been idle.

> When the user login (through telnetd) your .profile defines the environment and starts the application, so the shell process cannot be used to "TMOUT"...
> The system terminals could monitor idleness too?

Well, first you have to define idleness. Does it mean that the user has not pressed a key on the keyboard? Or does it mean that active data is not flowing in either direction? For example, the application might print to an attached printer and the report takes 2 hours to print. who -u will show no keyboard activity for 2 hours but you would not want to kill that session before the report was finished.

To accomplish what you want will require a fairly complicated program to monitor each copy of your licensed program. The Watcher program appears to only run on VMS, but the principle is still the same -- your program will have to look at some internal pieces of information.